Re: Small patch for runuser: disallow suid operation

• Russell Coker <russell@coker.com.au> [2005-11-12 11:12]:
  > On Thursday 20 October 2005 06:17, Thomas Bleher
  > <bleher@informatik.uni-muenchen.de> wrote:
  > > I think the following small patch should be applied to the coreutils
  > > package, on top of the existing patch:
  >
  > Sounds reasonable to me. Have you filed a bugzilla?
  

Just filed as
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=173113

> > --- runuser.c.orig 2005-10-19 22:01:57.000000000 +0200
> > +++ runuser.c 2005-10-19 22:00:53.000000000 +0200
> > @@ -19,6 +19,8 @@
> > return PAM_SUCCESS;
> > }
> > int pam_open_session(pam_handle_t *pamh, int flags){
> > + if (getuid() != geteuid()) /* safety net: deny operation if we are suid
> > by accident */ + error(EXIT_FAIL, 1, "runuser may not be setuid");
> > return PAM_SUCCESS;
> > }
> > int pam_close_session(pam_handle_t *pamh, int flags){
>

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.